Multi-tier Web Applications Research Articles

VulPathsFinder: A Static Method for Finding Vulnerable Paths in PHP Applications Based on CPG

Today, as PHP application technology is becoming increasingly mature, the functions of modern multi-layer web applications are becoming more and more complete, and the complexity is also gradually increasing. While providing developers with various business functions and interfaces, multi-tier Web applications also successfully cover the details of application development. This type of web application adopts a unified entrance, many object-oriented codes are used, and features such as encapsulation, inheritance, and polymorphism bring challenges to vulnerability mining from the perspective of static analysis. A large amount of object-oriented code makes it impossible for a simple function name-matching method to build a complete call graph (CG), resulting in the inability to perform a comprehensive interprocedural analysis. At the same time, the encapsulation feature of the class makes the data hidden in the object attribute, and the vulnerability path cannot be obtained through the general data-flow analysis. In response to the above issues, we propose a vulnerability detection method that supports vulnerability detection for multi-layer web applications based on MVC (Model-View-Control) architecture. First, we improve the construction of the call graph and Code Property Graph (CPG). Then, based on the enhanced Code Property Graph, we propose a technique to support vulnerability detection for multi-layer web applications. Based on this approach, we implemented a prototype of VulPathsFinder, a security analysis tool extended from the PHP security analyzer Joern-PHP. Then, we select ten MVC based and ten non-MVC-based applications to form a test dataset and validate the effectiveness of VulPathsFinder based on this dataset. Experimental results show that, compared with currently available tools, VulPathsFinder can handle framework applications more effectively, build a complete code property map, and detect vulnerabilities in framework applications that existing tools cannot detect.

Predictive Auto-Scaling of Multi-Tier Applications Using Performance Varying Cloud Resources

The performance of the same type of cloud resources, such as virtual machines (VMs), varies over time mainly due to hardware heterogeneity, resource contention among co-located VMs, and virtualization overhead. The performance variation can be significant, introducing challenges to learn workload-specific resource provisioning policies to automatically scale the cloud-hosted applications to maintain the desired response time. Moreover, auto-scaling multi-tier applications using minimal resources is even more challenging because bottlenecks may occur on multiple tiers concurrently. In this paper, we address the problem of using performance varying VMs for gracefully auto-scaling a multi-tier application using minimal resources to handle dynamically increasing workloads and satisfy the response time requirements. The proposed system uses a supervised learning method to identify the appropriate resources provisioning for multi-tier applications based on the prediction of the application response time and the request arrival rate. The supervised learning method learns a state transition configuration map which encodes a resource allocation states invariant to the underlying VMs performance variations. This configuration map helps to use performance varying resources in predictive autoscaling method. Our experimental evaluation using a real-world multi-tier web application hosted on a public cloud shows an improved application performance with minimal resources compared to conventional predictive auto-scaling methods.

Моделирование процессов обработки данных экологического мониторинга в облачной инфраструктуре

A model of a cloud-based system for processing environmental monitoring data is proposed. The model takes into account the multi-tier web applications and the heterogeneity of the input flow of applications. As a characteristic of the efficiency of the data processing system, an additive criterion is chosen that takes into account the volume of processed requests and the load on the resources of the cloud infrastructure. The approach under consideration will allow creating a basis for modeling the processes occurring in natural-technical systems (NTS), analyze data processing processes during monitoring of key performance indicators of NТS and ensure that these indicators meet the requirements specified in SLA agreements through the use of alternative data processing strategies.

SPARE: Partial Replication for Multi-Tier Applications in the Cloud

Offering consistent low latency remains a key challenge for distributed applications, especially when deployed on the cloud where virtual machines (VMs) suffer from capacity variability caused by co-located tenants. Replicating redundant requests was shown to be an effective mechanism to defend application performance from high capacity variability. While the prior art centers on single-tier systems, it still remains an open question how to design replication strategies for distributed multi-tier systems. In this paper, we design a first of its kind PArtial REplication system, sPARE, that replicates and dispatches read-only workloads for distributed multi-tier web applications. The two key components of sPARE are (i) the variability-aware replicator that coordinates the replication levels on all tiers via an iterative searching algorithm, and (ii) the replication-aware arbiter that uses a novel token-based arbitration algorithm (TAD) to dispatch requests in each tier. We evaluate sPARE on web serving and searching applications, i.e., MediaWiki and Solr, the former deployed on our private cloud and the latter on Amazon EC2. Our results based on various interference patterns and traffic loads show that sPARE is able to improve the tail latency of MediaWiki and Solr by a factor of almost 2.7x and 2.9x, respectively.

NVIDIA GPU Performance Monitoring using an Extension for Dynatrace OneAgent

This work presents a Dynatrace OneAgent extension for gathering NVIDIA GPU metrics using NVIDIA Management Library (NVML). The extension integrates GPU metrics into an industry-leading platform for Application Performance Management extending its capability of monitoring important business workloads to the GPU-oriented computational nodes. A practical approach for acquiring and processing NVML metrics via Python bindings is described. The work also proposes and discusses implementation of helper applications for convenient simulation of performance problems in a multi-tier web application. These applications are then used in combination with OneAgent-based monitoring and appropriate configuration of Dynatrace platform for web application monitoring. Next, an end-to-end production-like scenarios are presented, which exemplify extension usefulness in test setup resembling a real world implementation. The extension has been released on GitHub under MIT license.

A fault detection and diagnosis approach for multi-tier application in cloud computing

Ensuring the availability of cloud computing services always concerns both service providers and end users. Therefore, the system always needs precautions for unexpected cases. Accordingly, cloud computing services must be capable of identifying faults and behaving appropriately when it is abnormal to ensure the smoothness as well as the service quality. In this study, we propose a fault detection method for multi-tier web application in cloud computing deployment environment based on the Fuzzy One-class support vector machine and Exponentially Weighted Moving Average method. And then, the suspicious metrics are located by using feature selection method which based on Random Forest algorithm. To evaluate our approach, a multi-tier application is deployed by a transnational web e-Commerce benchmark by using TPC-W (TPC Benchmark™ W, simulates the activities of a business oriented transaction web server in a controlled internet commerce environment) in private cloud and then it is injected typical faults. The effectiveness of the fault detection and diagnosis are demonstrated in experiment results.

LWeb: information flow security for multi-tier web applications

This paper presents LWeb, a framework for enforcing label-based, information flow policies in database-using web applications. In a nutshell, LWeb marries the LIO Haskell IFC enforcement library with the Yesod web programming framework. The implementation has two parts. First, we extract the core of LIO into a monad transformer (LMonad) and then apply it to Yesod’s core monad. Second, we extend Yesod’s table definition DSL and query functionality to permit defining and enforcing label-based policies on tables and enforcing them during query processing. LWeb’s policy language is expressive, permitting dynamic per-table and per-row policies. We formalize the essence of LWeb in the λ LWeb calculus and mechanize the proof of noninterference in Liquid Haskell. This mechanization constitutes the first metatheoretic proof carried out in Liquid Haskell. We also used LWeb to build a substantial web site hosting the Build it, Break it, Fix it security-oriented programming contest. The site involves 40 data tables and sophisticated policies. Compared to manually checking security policies, LWeb imposes a modest runtime overhead of between 2% to 21%. It reduces the trusted code base from the whole application to just 1% of the application code, and 21% of the code overall (when counting LWeb too).

Dynamic Horizontal and Vertical Scaling for Multi-tier Web Applications

Dynamic Horizontal and Vertical Scaling for Multi-tier Web Applications

Power-network aware VM migration heuristics for multi-tier web applications

Cloud computing has become an attractive and promising platform, offering on-demand resources for multi-tier web applications. However, an inappropriate and inefficient resource management practices may negatively affect the service level agreement (SLA) and the response time experienced by users, essentially for high load operating conditions. Furthermore, this may result in substantial amount of energy consumption in data centers, which consequently leads to a high operational cost. This paper proposes an effective power-network aware virtual machine (VM) migration heuristics to deal with high SLA violation (SLAV) and energy consumption. Our research consists of two parts. The first part introduces a network-aware VM migration algorithm. The algorithm considers steady-state traffic condition to minimize the negative effect of migration on other flows. The network gain (NG) is calculated for candidate VMs and the VM with the maximum NG is selected. The second part, extends the network-aware algorithm with energy-awareness capabilities. In addition to NG, power gain (PG) is calculated for each candidate VM and two lists are created for each congested link: NG list and PG list. The VM with the lowest sum of the rank is selected. An extensive simulation is done in CloudSim. The results show that the power-network aware algorithm can reduce the energy consumption without significant increase in SLAV. This research enables us to take a step further towards building low latency, energy-efficient and environment-friendly data centers running network intensive applications.

Search-based Tier Assignment for Optimising Offline Availability in Multi-tier Web Applications

Web programmers are often faced with several challenges in the development process of modern, rich internet applications. Technologies for the different tiers of the application have to be selected: a server-side language, a combination of JavaScript, HTML and CSS for the client, and a database technology. Meeting the expectations of contemporary web applications requires even more effort from the developer: many state of the art libraries must be mastered and glued together. This leads to an impedance mismatch problem between the different technologies and it is up to the programmer to align them manually. Multi-tier or tierless programming is a web programming paradigm that provides one language for the different tiers of the web application, allowing the programmer to focus on the actual program logic instead of the accidental complexity that comes from combining several technologies. While current tierless approaches therefore relieve the burden of having to combine different technologies into one application, the distribution of the code is explicitly tied into the program. Certain distribution decisions have an impact on crosscutting concerns such as information security or offline availability. Moreover, adapting the programs such that the application complies better with these concerns often leads to code tangling, rendering the program more difficult to understand and maintain. We introduce an approach to multi-tier programming where the tierless code is decoupled from the tier specification. The developer implements the web application in terms of slices and an external specification that assigns the slices to tiers. A recommender system completes the picture for those slices that do not have a fixed placement and proposes slice refinements as well. This recommender system tries to optimise the tier specification with respect to one or more crosscutting concerns. This is in contrast with current cutting edge solutions that hide distribution decisions from the programmer. In this paper we show that slices, together with a recommender system, enable the developer to experiment with different placements of slices, until the distribution of the code satisfies the programmer's needs. We present a search-based recommender system that maximises the offline availability of a web application and a concrete implementation of these concepts in the tier-splitting tool Stip.js.

Asynchronous synthesis techniques for coordinating autonomic managers in the cloud

Cloud computing allows the delivery of on-demand computing resources over the Internet on a pay-for-use basis. From a technical point of view, cloud applications usually consist of several software components deployed on remote virtual machines. Managing such applications is a challenging problem because manual administration is no longer realistic for these complex distributed systems. Thus, autonomic computing is a promising solution for monitoring and updating these applications automatically. This is achieved through the automation of administration functions and the use of control loops called autonomic managers. An autonomic manager observes the environment, detects changes, and reconfigures dynamically the application. Multiple autonomic managers can be deployed in the same system and must make consistent decisions. Using them without coordination may lead to inconsistencies and error-prone situations. In this article, we first present a simple language for expressing coordination constraints given a set of autonomic managers. Second, given a coordination expression written with that language, we propose new synthesis techniques for automatically generating an asynchronous controller. These synthesis techniques work in two steps by successively generating a model of the controller and a Java object corresponding to this model. This Java code is finally used for deploying the generated controller. As far as evaluation is concerned, we validated our approach by using it for coordinating real-world cloud applications. • A new approach for coordinating multiple autonomic managers for distributed cloud applications. • New synthesis techniques for generating centralised controllers in asynchronous environments (FIFO-based communication). • A fully automated tool support that covers the whole development process from the requirements to the final deployment of our solution. • The evaluation of our approach on real-world multi-tier Web applications.

Multitier 웹 어플리케이션 환경에서 악의적인 SQL Query 탐지를 위한 HTTP Request - SQL Query 매핑 기법

Multitier 웹 어플리케이션 환경에서 악의적인 SQL Query 탐지를 위한 HTTP Request - SQL Query 매핑 기법

Unsupervised Learning of Dynamic Resource Provisioning Policies for Cloud-Hosted Multitier Web Applications

Dynamic resource provisioning for Web applications allows for low operational costs while meeting service-level objectives (SLOs). However, the complexity of multitier Web applications makes it difficult to automatically provision resources for each tier without human supervision. In this paper, we introduce unsupervised machine learning methods to dynamically provision multitier Web applications, while observing user-defined performance goals. The proposed technique operates in real time and uses learning techniques to identify workload patterns from access logs, reactively identifies bottlenecks for specific workload patterns, and dynamically builds resource allocation policies for each particular workload. We demonstrate the effectiveness of the proposed approach in several experiments using synthetic workloads on the Amazon Elastic Compute Cloud (EC2) and compare it with industry-standard rule-based autoscale strategies. Our results show that the proposed techniques would enable cloud infrastructure providers or application owners to build systems that automatically manage multitier Web applications, while meeting SLOs, without any prior knowledge of the applications' resource utilization or workload patterns.

Prediction-based VM provisioning and admission control for multi-tier web applications

We present a prediction-based, cost-efficient Virtual Machine (VM) provisioning and admission control approach for multi-tier web applications. The proposed approach provides automatic deployment and scaling of multiple web applications on a given Infrastructure as a Service (IaaS) cloud. It monitors and uses collected resource utilization metrics itself and does not require a performance model of the applications or the infrastructure dynamics. The approach uses the OSGi component model to share VM resources among deployed applications, reducing the total number of required VMs. The proposed approach comprises three sub-approaches: a reactive VM provisioning approach called ARVUE, a hybrid reactive-proactive VM provisioning approach called Cost-efficient Resource Allocation for Multiple web applications with Proactive scaling (CRAMP), and a session-based adaptive admission control approach called adaptive Admission Control for Virtualized Application Servers (ACVAS). Performance under varying load conditions is guaranteed by automatic adjustment and tuning of the CRAMP and ACVAS parameters. The proposed approach is demonstrated in discrete-event simulations and is evaluated in a series of experiments involving synthetic as well as realistic load patterns.

Catfish-PSO based scheduling of scientific workflows in IaaS cloud

Cloud computing is a technology wherein a network of remote servers is used to process large amount of data in real-time. The servers and data sources may be located in geographically distant regions. Scheduling of workflows is one of the major challenging issues in cloud computing. Workflows are used to express a wide variety of applications including scientific computing and multi-tier web applications. The Workflow scheduling problem is known to be NP-complete. No known traditional scheduling algorithm is able to provide an optimal solution in polynomial time for NP-complete problems. So, researchers rely on heuristics and meta-heuristics to achieve the most efficient solution. In this paper, a workflow scheduling algorithm is proposed to schedule large scientific workflows that are to be executed on IaaS clouds. The workflow scheduling algorithm generates a schedule with the task-to-resource mapping. The metaheuristic Catfish particle swarm optimization (C-PSO) technique is used to select the best schedule with the least makespan and execution cost. The performance of C-PSO is then compared with traditional PSO. The algorithm is simulated on the WorkFlowSim Simulator, an extension of CloudSim simulator. The solution is tested for different types of scientific workflows like Montage, Epigenome, CyberShake and Inspiral. It is observed from the experimental results that C-PSO gives better performance than traditional PSO in terms of execution cost and makespan.

A Survey of Quality of Service in Multi-tier Web Applications

A Survey of Quality of Service in Multi-tier Web Applications

Performance Modeling of Multi-tiered Web Applications with Varying Service Demands

Multi-tiered transactional web applications are frequently used in IT enterprise based systems. Due to their inherent distributed nature, pre-deployment testing for high-availability and varying concurrency are important for post-deployment performance. Accurate performance modeling of such applications can help estimate values for future deployment variations as well as validate experimental results. In order to theoretically model performance of multi-tiered applications, we use queuing networks and Mean Value Analysis (MVA) models. While MVA has been shown to work well with closed queuing networks, there are particular limitations in cases where the service demands vary with concurrency. This variation of service demands for various resources (CPU, Disk, Network) is demonstrated through multiple experiments. This is further contrived by the use of multi-server queues in multi-core CPUs, that are not traditionally captured in MVA. We compare performance of a multi-server MVA model alongside actual performance testing measurements and demonstrate this deviation. Using spline interpolation of collected service demands, we show that a modified version of the MVA algorithm (called MVASD ) that accepts an array of service demands, can provide superior estimates of maximum throughput and response time. Results are demonstrated over multi-tier vehicle insurance registration and e-commerce web applications. The mean deviations of predicted throughput and response time are shown to be less the 3% and 9% , respectively. Additionally, we analyze the effect of spline interpolation of service demands as a function of throughput on the prediction results. Using Chebyshev Nodes , the tradeoff between the number of test points and the spline interpolation/prediction accuracy is also studied.Â

Workflow scheduling in cloud: a survey

To program in distributed computing environments such as grids and clouds, workflow is adopted as an attractive paradigm for its powerful ability in expressing a wide range of applications, including scientific computing, multi-tier Web, and big data processing applications. With the development of cloud technology and extensive deployment of cloud platform, the problem of workflow scheduling in cloud becomes an important research topic. The challenges of the problem lie in: NP-hard nature of task-resource mapping; diverse QoS requirements; on-demand resource provisioning; performance fluctuation and failure handling; hybrid resource scheduling; data storage and transmission optimization. Consequently, a number of studies, focusing on different aspects, emerged in the literature. In this paper, we firstly conduct taxonomy and comparative review on workflow scheduling algorithms. Then, we make a comprehensive survey of workflow scheduling in cloud environment in a problem---solution manner. Based on the analysis, we also highlight some research directions for future investigation.

Detection and Prevention of Intrusions in Multi-tier Web Application using Static and Dynamic Algorithm

Detection and Prevention of Intrusions in Multi-tier Web Application using Static and Dynamic Algorithm

Partitioning of web applications for hybrid cloud deployment

Abstract Hybrid cloud deployment offers flexibility in trade-offs between the cost-savings/scalability of the public cloud and control over data resources provided at a private premise. However, this flexibility comes at the expense of complexity in distributing a system over these two locations. For multi-tier web applications, this challenge manifests itself primarily in the partitioning of application- and database-tiers. While there is existing research that focuses on either application-tier or data-tier partitioning, we show that optimized partitioning of web applications benefits from both tiers being considered simultaneously. We present our research on a new cross-tier partitioning approach to help developers make effective trade-offs between performance and cost in a hybrid cloud deployment. The general approach primarily benefits from two technical improvements to integer-programming based application partitioning. First, an asymmetric cost-model for optimizing data transfer in environments where ingress and egress data-transfer have differing costs, such as in many infrastructure as a service platforms. Second, a new encoding of database query plans as integer programs, to enable simultaneous optimization of code and data placement in a hybrid cloud environment. In two case studies the approach results in up to 54% reduction in monetary costs compared to a premise only deployment and 56% improvement in response time compared to a naive partitioning where the application-tier is deployed in the public cloud and the data-tier is on private infrastructure.